Creativa Srl has adopted an Internal Procedure for Reporting Unlawful Conduct and Irregularities, which provides those who work and collaborate with the agency with a confidential channel through which to report facts learned in the work-related context. This notice describes the processing of personal data connected with that channel and supplements the general Privacy Policy of the website, to which reference is made for all matters not expressly addressed herein.

Data Controller

The data controller is Creativa Srl Impresa di Comunicazione, acting through its legal representative pro tempore, having its registered office at Corso Enrico Tazzoli 215/12B, 10137 Torino, Italy, Tax Code and VAT No. 07681270018, which may be contacted at servizioclienti@creativacomunica.com (the “Controller”).

The Controller has not appointed a Data Protection Officer, since the conditions laid down in Article 37 of the Regulation are not met.

Designated Officer for Reports

The receipt and assessment of reports are entrusted to Avv. Gianlupo Macolino, an external professional who is not part of the organisation (the “Designated Officer”).

The processor pursuant to Article 28 of the Regulation is Mr Roberto Amarotto.

The Designated Officer operates autonomously from the company’s internal functions. The email address dedicated to reports is reserved exclusively for the Designated Officer and is not accessible to any function of the Controller.

Categories of Data Subjects and Personal Data Processed

The processing may concern the personal data of: the person making the report; the persons to whom the violation is attributed or who are otherwise involved in it; the persons mentioned in the report; and those assisting the reporting person.

The categories of data processed are:

Reporting persons are invited to limit the information provided to what is strictly relevant to the facts reported and to refrain from disclosing unnecessary data, particularly where such data concern the health, personal beliefs or other aspects of the private life of third parties.

Purposes and Legal Bases of the Processing

Personal data are processed for the following purposes:

The legal bases are as follows.

The provision of data is optional. Reports may be made anonymously; anonymity may, however, limit the scope for further investigation and precludes any subsequent communication with the reporting person.

Processing Methods and Confidentiality

The processing is carried out by electronic means, through technical and organisational measures appropriate to the risk pursuant to Article 32 of the Regulation, including: access restricted to the Designated Officer alone by means of personal credentials and multi-factor authentication; encryption of the stored documentation; a prohibition on duplicating reports or forwarding them to other addresses; and a prohibition on creating local copies on devices not under the exclusive control of the Designated Officer.

The identity of the reporting person and any information from which it may be inferred are not disclosed, without the reporting person’s express consent, to persons other than those competent to receive or follow up on the report. Where knowledge of that identity is indispensable to enable the person concerned to exercise the right of defence, the reporting person is informed thereof in advance in writing, with a statement of the reasons.

Reports are not used beyond what is necessary to follow them up adequately. No automated decision-making or profiling is carried out.

Authorised Persons and Recipients

The data may be accessed exclusively by the Designated Officer and by any collaborators expressly authorised and instructed by the Designated Officer pursuant to Article 29 of the Regulation and Article 2-quaterdecies of the Privacy Code, who are bound by a duty of confidentiality.

To the extent strictly necessary, the data may be disclosed to the Controller’s management body for the purpose of adopting the resulting measures, to the competent authorities where the facts must be referred to them, and to the Controller’s legal counsel for the establishment, exercise or defence of legal claims. The data are not disseminated.

No transfer of personal data to third countries or international organisations is envisaged.

Retention Period

Reports and the related documentation are retained for as long as necessary to handle them and, in any event, for no longer than five years from the date on which the final outcome of the procedure is communicated to the reporting person, after which they are erased.

Records and documents relating to any proceedings initiated and to any action taken by the Controller following a report are retained in accordance with the retention periods applicable to them and, as a rule, contain no references capable of identifying the reporting person.

Rights of Data Subjects

Data subjects may exercise the rights provided for in Articles 15 to 22 of the Regulation — access, rectification, erasure, restriction, portability and objection — by contacting the Controller at the contact details set out in the “Data Controller” section above.

Pursuant to Article 2-undecies, paragraph 1, letter (e), of the Privacy Code, such rights may not be exercised where their exercise could result in actual and concrete prejudice to the conduct of defence investigations or to the exercise of a right in legal proceedings and, in any event, where exercising the right would entail disclosing the identity of the reporting person. In such cases, the exercise of the rights may be delayed, restricted or excluded by means of a reasoned notice to the data subject, for such time and to such extent as this constitutes a necessary and proportionate measure.

In the same circumstances, the rights may also be exercised through the Italian Data Protection Authority (Garante per la protezione dei dati personali, the “Garante”), in the manner set out in Article 160 of the Privacy Code. The Garante informs the data subject that it has carried out all necessary verifications or a review, and of the data subject’s right to seek a judicial remedy.

The right to lodge a complaint with the Garante (www.garanteprivacy.it) or to bring proceedings before the courts remains unaffected.

Updates

This notice may be updated to reflect organisational or regulatory changes. The version in force is always available in this section of the website.

Last updated: 30 September 2026